rcuwalk: recheck mount_lock after mountpoint crossing attempts
We can get false negative from __lookup_mnt() if an unrelated vfsmount gets moved. In that case legitimize_mnt() is guaranteed to fail, and we will fall back to non-RCU walk... unless we end up running into a hard error on a filesystem object we wouldn't have reached if not for that false negative. IOW, delaying that check until the end of pathname resolution is wrong - we should recheck right after we attempt to cross the mountpoint. We don't need to recheck unless we see d_mountpoint() being true - in that case even if we have just raced with mount/umount, we can simply go on as if we'd come at the moment when the sucker wasn't a mountpoint; if we run into a hard error as the result, it was a legitimate outcome. __lookup_mnt() returning NULL is different in that respect, since it might've happened due to operation on completely unrelated mountpoint. Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
parent
e825196d48
commit
b37199e626
29
fs/namei.c
29
fs/namei.c
|
@ -1109,7 +1109,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
if (!d_mountpoint(path->dentry))
|
if (!d_mountpoint(path->dentry))
|
||||||
break;
|
return true;
|
||||||
|
|
||||||
mounted = __lookup_mnt(path->mnt, path->dentry);
|
mounted = __lookup_mnt(path->mnt, path->dentry);
|
||||||
if (!mounted)
|
if (!mounted)
|
||||||
|
@ -1125,20 +1125,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
|
||||||
*/
|
*/
|
||||||
*inode = path->dentry->d_inode;
|
*inode = path->dentry->d_inode;
|
||||||
}
|
}
|
||||||
return true;
|
return read_seqretry(&mount_lock, nd->m_seq);
|
||||||
}
|
|
||||||
|
|
||||||
static void follow_mount_rcu(struct nameidata *nd)
|
|
||||||
{
|
|
||||||
while (d_mountpoint(nd->path.dentry)) {
|
|
||||||
struct mount *mounted;
|
|
||||||
mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
|
|
||||||
if (!mounted)
|
|
||||||
break;
|
|
||||||
nd->path.mnt = &mounted->mnt;
|
|
||||||
nd->path.dentry = mounted->mnt.mnt_root;
|
|
||||||
nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static int follow_dotdot_rcu(struct nameidata *nd)
|
static int follow_dotdot_rcu(struct nameidata *nd)
|
||||||
|
@ -1166,7 +1153,17 @@ static int follow_dotdot_rcu(struct nameidata *nd)
|
||||||
break;
|
break;
|
||||||
nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
|
nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
|
||||||
}
|
}
|
||||||
follow_mount_rcu(nd);
|
while (d_mountpoint(nd->path.dentry)) {
|
||||||
|
struct mount *mounted;
|
||||||
|
mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
|
||||||
|
if (!mounted)
|
||||||
|
break;
|
||||||
|
nd->path.mnt = &mounted->mnt;
|
||||||
|
nd->path.dentry = mounted->mnt.mnt_root;
|
||||||
|
nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
|
||||||
|
if (!read_seqretry(&mount_lock, nd->m_seq))
|
||||||
|
goto failed;
|
||||||
|
}
|
||||||
nd->inode = nd->path.dentry->d_inode;
|
nd->inode = nd->path.dentry->d_inode;
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue